urlscan.io logo urlscan.io
SecurityTrails logo

n3plcpnl0262.prod.ams3.secureserver.net Open in urlscan Pro
160.153.155.18  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Submission: On January 28 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 7 countries across 7 domains to perform 21 HTTP transactions. The main IP is 160.153.155.18, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is n3plcpnl0262.prod.ams3.secureserver.net.
TLS certificate: Issued by Starfield Secure Certificate Authorit... on April 16th 2018. Valid for: 2 years.
This is the only time n3plcpnl0262.prod.ams3.secureserver.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nexi (Banking)

Domain & IP information

IP Address AS Autonomous System
1 160.153.155.18 26496 (AS-26496-...)
2 2a00:1450:400... 15169 (GOOGLE)
1 37.157.4.41 198622 (ADFORM)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 147.75.205.49 54825 (PACKET)
1 2a00:1450:400... 15169 (GOOGLE)
2 147.75.81.98 54825 (PACKET)
3 185.198.116.51 3269 (ASN-IBSNAZ)
1 151.99.162.64 3269 (ASN-IBSNAZ)
21 11
1    160.153.155.18 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: n3plcpnl0262.prod.ams3.secureserver.net
n3plcpnl0262.prod.ams3.secureserver.net
2    2a00:1450:4001:816::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    37.157.4.41 (Denmark)

ASN198622 (ADFORM, DK)
track.adform.net
2    2a00:1450:4001:817::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    2a00:1450:4001:808::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
1    147.75.205.49 (Amsterdam, Netherlands)

ASN54825 (PACKET - Packet Host, Inc., US)
PTR: pkt-ams-k1-26
static.hotjar.com
1    2a00:1450:4001:819::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
2    147.75.81.98 (Switzerland)

ASN54825 (PACKET - Packet Host, Inc., US)
PTR: pkt-ams-k1-30
script.hotjar.com
3    185.198.116.51 (None, )

ASN3269 (ASN-IBSNAZ, IT)
privati.nexi.it
1    151.99.162.64 (Italy)

ASN3269 (ASN-IBSNAZ, IT)
www.nexi.it
Domain Requested by
3 privati.nexi.it n3plcpnl0262.prod.ams3.secureserver.net
ajax.googleapis.com
2 script.hotjar.com n3plcpnl0262.prod.ams3.secureserver.net
static.hotjar.com
2 ajax.googleapis.com n3plcpnl0262.prod.ams3.secureserver.net
2 www.google-analytics.com n3plcpnl0262.prod.ams3.secureserver.net
1 www.nexi.it n3plcpnl0262.prod.ams3.secureserver.net
1 fonts.googleapis.com n3plcpnl0262.prod.ams3.secureserver.net
1 static.hotjar.com n3plcpnl0262.prod.ams3.secureserver.net
1 www.googletagmanager.com n3plcpnl0262.prod.ams3.secureserver.net
1 track.adform.net n3plcpnl0262.prod.ams3.secureserver.net
1 n3plcpnl0262.prod.ams3.secureserver.net
21 10

This site contains no links.

Subject Issuer Validity Valid
*.prod.ams3.secureserver.net
Starfield Secure Certificate Authority - G2		 2018-04-16 -
2020-04-16		 2 years crt.sh
*.google-analytics.com
Google Internet Authority G3		 2018-12-19 -
2019-03-13		 3 months crt.sh
track.adform.net
DigiCert SHA2 Secure Server CA		 2018-02-02 -
2019-10-02		 2 years crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-12-19 -
2019-03-13		 3 months crt.sh
static.hotjar.com
Let's Encrypt Authority X3		 2018-12-10 -
2019-03-10		 3 months crt.sh
script.hotjar.com
Let's Encrypt Authority X3		 2018-12-10 -
2019-03-10		 3 months crt.sh
privati.nexi.it
DigiCert SHA2 Extended Validation Server CA		 2018-06-18 -
2019-06-19		 a year crt.sh
www.nexi.it
DigiCert SHA2 Extended Validation Server CA		 2018-06-25 -
2019-06-26		 a year crt.sh

This page contains 1 frames:

Primary Page: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Frame ID: 47124D39A80B3CF7ACE0E84D7209BBE8
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
  • script /googleapis\.com\/.+webfont/i
Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i
Overall confidence: 100%
Detected patterns
  • script /^\/\/static\.hotjar\.com\/c\/hotjar-/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

21
Requests

71 %
HTTPS

40 %
IPv6

7
Domains

10
Subdomains

11
IPs

7
Countries

728 kB
Transfer

4436 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set email.php
n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/ 		11 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.155.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
n3plcpnl0262.prod.ams3.secureserver.net
Software
Apache / PHP/7.2.8
Resource Hash
e442b4329342aa9b68ef13fad7add7d55a5d975200b53e494d58cf7dac6ac9a0

Request headers

Host
n3plcpnl0262.prod.ams3.secureserver.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 28 Jan 2019 16:16:38 GMT
Server
Apache
X-Powered-By
PHP/7.2.8
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=79c94ab041ba91884363cc44fc6d0dcf; path=/
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
2444
Keep-Alive
timeout=5
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
ec.js
www.google-analytics.com/plugins/ua/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 28 Jan 2019 16:00:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
959
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
1296
x-xss-protection
1; mode=block
expires
Mon, 28 Jan 2019 17:00:39 GMT
/
track.adform.net/serving/scripts/trackpoint/async/ 		76 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/scripts/trackpoint/async/
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
a631e8098179b4b6feaca08bce747cb8b3c53450c3fe30eead2c3f23dd288265

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 28 Jan 2019 16:16:38 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
*
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
status
200
cache-control
public, max-age=604800
content-type
text/javascript; charset=utf-8
content-length
30712
expires
Mon, 04 Feb 2019 16:16:38 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
1651
date
Mon, 28 Jan 2019 15:49:07 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
17543
expires
Mon, 28 Jan 2019 17:49:07 GMT
webfont.js
ajax.googleapis.com/ajax/libs/webfont/1/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:817::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 23 Jan 2019 19:24:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
420758
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
5437
x-xss-protection
1; mode=block
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 23 Jan 2020 19:24:00 GMT
gtm.js
www.googletagmanager.com/ 		256 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-P76R79S
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:808::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
7df64b6823c3a373c42eadf31d8b1e015b3a9cd8a5a35b6162e38d3188dd56d4
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 28 Jan 2019 16:16:38 GMT
content-encoding
gzip
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
49724
x-xss-protection
1; mode=block
expires
Mon, 28 Jan 2019 16:16:38 GMT
hotjar-643217.js
static.hotjar.com/c/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-643217.js?sv=5
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.205.49 Amsterdam, Netherlands, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
pkt-ams-k1-26
Software
/
Resource Hash
8e2e24d9f5f2ea2967c9e166fb11cecd011353c3a4eb6d20feb6e9659b1aa645
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 28 Jan 2019 16:16:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
*
etag
W/d6de86ce518fa7dd52ddddec57fbac2c
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
max-age=60
section-io-origin-time-seconds
0.072
section-io-origin-status
200
accept-ranges
bytes
section-io-id
fbbd8758dfc51aaf9b9e6c262eebe105
content-length
1067
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.7.2/ 		93 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:817::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 10:06:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2182216
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
33845
x-xss-protection
1; mode=block
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Jan 2020 10:06:22 GMT
css
fonts.googleapis.com/ 		5 KB
710 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600&subset=latin
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:819::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
4c9151ec30fd2126494b4e022b181ec87b46a1839450d31a7afa00269983022c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 28 Jan 2019 16:16:38 GMT
server
ESF
access-control-allow-origin
*
date
Mon, 28 Jan 2019 16:16:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Mon, 28 Jan 2019 16:16:38 GMT
modules-79263abf7d750edcf2ac9b3f61c10e5a.js
script.hotjar.com/ 		400 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules-79263abf7d750edcf2ac9b3f61c10e5a.js
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.81.98 , Switzerland, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
pkt-ams-k1-30
Software
/
Resource Hash
b15e7144c955c393a5d8f9dbe7935fc296336808b0a25e86240fbde6f6644c4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 28 Jan 2019 16:16:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Jan 2019 10:28:33 GMT
access-control-allow-origin
*
etag
W/"79263abf7d750edcf2ac9b3f61c10e5a"
content-type
application/javascript
status
200
cache-control
max-age=31536000
section-io-origin-time-seconds
0.051
content-length
82398
section-io-origin-status
200
accept-ranges
bytes
section-io-id
1e4a75add855775334de4622b9e4cace
x-amz-version-id
4y670bWU5PJu59GqghGBNvi4ffjpdaWc
vendor.222d70f6d6e470a9d211755bfbc35f22.css
privati.nexi.it/ 		14 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://privati.nexi.it/vendor.222d70f6d6e470a9d211755bfbc35f22.css
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.116.51 -, , ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
Software
/
Resource Hash
ae4697824881a6a6b5fe690d5652d24fbacae1586d0afa90213d7b2c18162938
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 28 Jan 2019 16:16:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Jan 2019 16:22:16 GMT
X-Frame-Options
SAMEORIGIN
ETag
"37bd-57f08dd7d5e00-gzip"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=31536000, private
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5, max=99
Content-Length
3807
Expires
Wed, 27 Feb 2019 16:16:38 GMT
app.976106247a3e6ce08a12fe8c08f86176.css
privati.nexi.it/ 		3 MB
412 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://privati.nexi.it/app.976106247a3e6ce08a12fe8c08f86176.css
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.116.51 -, , ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
Software
/
Resource Hash
76d05ecaa2cbaa3673adf02f407003d350e3f1ee0dfb302f3c1c44dec923d3f6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 28 Jan 2019 16:16:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Jan 2019 16:22:16 GMT
X-Frame-Options
SAMEORIGIN
ETag
"3070da-57f08dd7d5e00-gzip"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=31536000, private
Transfer-Encoding
chunked
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5, max=99
Expires
Wed, 27 Feb 2019 16:16:38 GMT
logo_dark.svg
privati.nexi.it/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://privati.nexi.it/logo_dark.svg
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.116.51 -, , ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
Software
/
Resource Hash
2ba20f95f1f9e59dced89ead82577dc71a3c0c7d9fa6b7dd9d1b3c0d638cf193
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 28 Jan 2019 16:16:38 GMT
Last-Modified
Wed, 09 Jan 2019 16:22:18 GMT
ETag
"a3b-57f08dd9be280"
X-Frame-Options
SAMEORIGIN
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=2592000, public
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Keep-Alive
timeout=5, max=99
Content-Length
2619
Expires
Wed, 27 Feb 2019 16:16:38 GMT
style.css
www.nexi.it/cookieservice/titolari-it/ 		17 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nexi.it/cookieservice/titolari-it/style.css
Requested by
Host: n3plcpnl0262.prod.ams3.secureserver.net
URL: https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
151.99.162.64 , Italy, ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
Software
/
Resource Hash
260f59a0f3ec205735c10ed1b28b0b42871437fa0f466bf61a386e6150ac4239

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 28 Jan 2019 16:16:38 GMT
Content-Encoding
gzip
Last-Modified
Mon, 23 Jul 2018 10:15:24 GMT
ETag
"433a-571a7ec7426b1-gzip"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5, max=99
Content-Length
4884
modules-7b804fe854a1eeafa15731d35d6b9a9e.js
script.hotjar.com/ 		400 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules-7b804fe854a1eeafa15731d35d6b9a9e.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-643217.js?sv=5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.81.98 , Switzerland, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
pkt-ams-k1-30
Software
/
Resource Hash
7f66b160113a32f723be4ca6e45a2ba5b21fa61f86bbf33a32333badd33f766f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://n3plcpnl0262.prod.ams3.secureserver.net/~ekcafq51l7h1/n3plcpnl0262/1e0fa/email.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 28 Jan 2019 16:16:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 25 Jan 2019 21:16:59 GMT
access-control-allow-origin
*
etag
W/"7b804fe854a1eeafa15731d35d6b9a9e"
content-type
application/javascript
status
200
cache-control
max-age=31536000
section-io-origin-time-seconds
0.025
content-length
82543
section-io-origin-status
200
accept-ranges
bytes
section-io-id
bda01efb38b8d37efbb46dce1e30862c
x-amz-version-id
iWp_8fLL5xflR1nKkVtOBRQr_Jpsk7Vp
karbon-regular-webfont.woff
privati.nexi.it/fonts/Karbon/ 		0
0
karbon-semibold-webfont.woff
privati.nexi.it/fonts/Karbon/ 		0
0
font-icon_2.3.woff
privati.nexi.it/fonts/font-icon/ 		0
0
karbon-semibold-webfont.ttf
privati.nexi.it/fonts/Karbon/ 		0
0
karbon-regular-webfont.ttf
privati.nexi.it/fonts/Karbon/ 		0
0
font-icon_2.3.ttf
privati.nexi.it/fonts/font-icon/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
privati.nexi.it
URL
https://privati.nexi.it/fonts/Karbon/karbon-regular-webfont.woff
Domain
privati.nexi.it
URL
https://privati.nexi.it/fonts/Karbon/karbon-semibold-webfont.woff
Domain
privati.nexi.it
URL
https://privati.nexi.it/fonts/font-icon/font-icon_2.3.woff
Domain
privati.nexi.it
URL
https://privati.nexi.it/fonts/Karbon/karbon-semibold-webfont.ttf
Domain
privati.nexi.it
URL
https://privati.nexi.it/fonts/Karbon/karbon-regular-webfont.ttf
Domain
privati.nexi.it
URL
https://privati.nexi.it/fonts/font-icon/font-icon_2.3.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| gaplugins function| ga function| $ function| jQuery object| google_tag_data object| WebFont object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| google_tag_manager object| dataLayer object| Adform object| KJUR object| adf function| hj object| _hjSettings

1 Cookies

Domain/Path Name / Value
n3plcpnl0262.prod.ams3.secureserver.net/ Name: PHPSESSID
Value: 79c94ab041ba91884363cc44fc6d0dcf

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
n3plcpnl0262.prod.ams3.secureserver.net
privati.nexi.it
script.hotjar.com
static.hotjar.com
track.adform.net
www.google-analytics.com
www.googletagmanager.com
www.nexi.it
privati.nexi.it
147.75.205.49
147.75.81.98
151.99.162.64
160.153.155.18
185.198.116.51
2a00:1450:4001:808::2008
2a00:1450:4001:816::200e
2a00:1450:4001:817::200a
2a00:1450:4001:819::200a
37.157.4.41
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
260f59a0f3ec205735c10ed1b28b0b42871437fa0f466bf61a386e6150ac4239
2ba20f95f1f9e59dced89ead82577dc71a3c0c7d9fa6b7dd9d1b3c0d638cf193
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
4c9151ec30fd2126494b4e022b181ec87b46a1839450d31a7afa00269983022c
76d05ecaa2cbaa3673adf02f407003d350e3f1ee0dfb302f3c1c44dec923d3f6
7df64b6823c3a373c42eadf31d8b1e015b3a9cd8a5a35b6162e38d3188dd56d4
7f66b160113a32f723be4ca6e45a2ba5b21fa61f86bbf33a32333badd33f766f
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
8e2e24d9f5f2ea2967c9e166fb11cecd011353c3a4eb6d20feb6e9659b1aa645
a631e8098179b4b6feaca08bce747cb8b3c53450c3fe30eead2c3f23dd288265
ae4697824881a6a6b5fe690d5652d24fbacae1586d0afa90213d7b2c18162938
b15e7144c955c393a5d8f9dbe7935fc296336808b0a25e86240fbde6f6644c4b
e442b4329342aa9b68ef13fad7add7d55a5d975200b53e494d58cf7dac6ac9a0